Federated learning is proposed to protect data privacy by keeping private data localized and sharing only model gradients or parameters. However, recent research on Deep Leakage from Gradients (DLG) demonstrates [1]} that shared gradients can actually leak private training data. Particularly, DLG can achieve pixel-wise level data recovery without any assistance information. A follow-up work [2]} shows that label information can also be restored from gradients of the last layer of a client's model. [3]} further extends DLG to more realistic settings where gradients are averaged over several iterations or several images and shows that users' privacy is not protected in these settings. GRNN [4]} improves DLG by recovering fake data and labels through a generative model instead of regressing them directly from random initialization.
